Harden Release Drafter workflow#423
Merged
amishas157 merged 2 commits intorelease-v20260512from May 6, 2026
Merged
Conversation
Migrate the deprecated ::set-output workflow command to $GITHUB_OUTPUT, and pass branch name / version values through env: rather than re-interpolating them into bash. Closes a script-injection class on the release path and unblocks future runner-image upgrades that drop ::set-output support. Follows GitHub's Actions security hardening guidance for handling untrusted context in run blocks.
There was a problem hiding this comment.
Pull request overview
This PR hardens the Release Drafter GitHub Actions workflow by replacing the deprecated ::set-output command with $GITHUB_OUTPUT and reducing interpolation of PR-controlled values inside run: blocks, aligning with GitHub Actions security hardening guidance while preserving existing behavior.
Changes:
- Migrates step outputs (
BRANCH,TAG,NEXT_VERSION) from::set-outputto$GITHUB_OUTPUT. - Passes
BRANCH_NAME,CURRENT_VERSION, andNEXT_VERSIONthroughenv:to avoid re-interpolating expressions into shell scripts. - Adds quoting in branch-pattern checks and tag creation/push commands for safer shell execution.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Migrate the deprecated
::set-outputworkflow command to$GITHUB_OUTPUT, and pass branch / version values throughenv:rather than re-interpolating them into bash. This:run:blocks (matches GitHub's Actions hardening guide).::set-outputsupport.Behavior is unchanged — the workflow still produces the same
BRANCH,TAG, andNEXT_VERSIONstep outputs and uses them in the same downstream steps.Impact today is limited (workflow only runs on merged PRs from upstream branches), but the fix is mechanical defense-in-depth.
Test plan